xloader_apk | d1fa899df2718e7f47bb3a86e845e145ebdeeba1d29f9e44dc6eb483abb37bf1 | Triage

Sharing

General

Target

d1fa899df2718e7f47bb3a86e845e145ebdeeba1d29f9e44dc6eb483abb37bf1.bin
Size

164KB
Sample

250311-1zv66axxh1
MD5

292d2311b3bd4dc59b80c7c6db630248
SHA1

c0f49680bfb1bd78453945d6d8b7a0222b605b98
SHA256

d1fa899df2718e7f47bb3a86e845e145ebdeeba1d29f9e44dc6eb483abb37bf1
SHA512

82882f14418cf4d64c375173cd449e5ca72dcc0574c28e9b0ea45fe92f4fc86cb6450fbe90252e0ba29a6d070dadb0c15f0b4018b1187640e124eb4c438e5ded
SSDEEP

3072:OeVLNlS1u9djJlKDEElVysC+O5+CBljecfhNt5bpfXC0VZOru1jdf2kmFmovpdF9:OYNlHdJlKlTYBJ1fhNt5bpZZO61wkxgt

Score

10^/10

xloader_apk android banker defense_evasion evasion infostealer trojan

Malware Config

Extracted

Family

xloader_apk

C2

https://m.vk.com/id730148259?act=info

https://m.vk.com/id730149630?act=info

Attributes

user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Mobile Safari/537.36 Edg/112.0.0.0

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36

Targets

- Target
  
  d1fa899df2718e7f47bb3a86e845e145ebdeeba1d29f9e44dc6eb483abb37bf1.bin
- Size
  
  164KB
- MD5
  
  292d2311b3bd4dc59b80c7c6db630248
- SHA1
  
  c0f49680bfb1bd78453945d6d8b7a0222b605b98
- SHA256
  
  d1fa899df2718e7f47bb3a86e845e145ebdeeba1d29f9e44dc6eb483abb37bf1
- SHA512
  
  82882f14418cf4d64c375173cd449e5ca72dcc0574c28e9b0ea45fe92f4fc86cb6450fbe90252e0ba29a6d070dadb0c15f0b4018b1187640e124eb4c438e5ded
- SSDEEP
  
  3072:OeVLNlS1u9djJlKDEElVysC+O5+CBljecfhNt5bpfXC0VZOru1jdf2kmFmovpdF9:OYNlHdJlKlTYBJ1fhNt5bpZZO61wkxgt
Score

10^/10

xloader_apk banker defense_evasion evasion infostealer trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Xloader_apk family
  xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xloader_apkbankerdefense_evasionevasioninfostealertrojan